CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add a note about testing analyzers outside of the Sensoroni Docker container

Browse Source
This commit is contained in:
weslambert
2023-09-25 14:39:33 -04:00
committed by GitHub
parent 2fc4d2923d
commit c95af6b992
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
salt/sensoroni/files/analyzers/README.md
View File

@@ -141,7 +141,6 @@ Additionally, to support airgapped users, the dependency packages themselves, an
pip download -r <my-analyzer-path>/requirements.txt -d <my-analyzer-path>/source-packages pip download -r <my-analyzer-path>/requirements.txt -d <my-analyzer-path>/source-packages
``` ```
### Analyzer Architecture ### Analyzer Architecture
The Sensoroni Docker container is responsible for executing analyzers. Only the manager's Sensoroni container will process analyzer jobs. Other nodes in the grid, such as sensors and search nodes, will not be assigned analyzer jobs. The Sensoroni Docker container is responsible for executing analyzers. Only the manager's Sensoroni container will process analyzer jobs. Other nodes in the grid, such as sensors and search nodes, will not be assigned analyzer jobs.
@@ -154,6 +153,12 @@ The analyzer itself will only run when a user in SOC enqueues an analyzer job, s
python -m urlhaus '{"artifactType":"url","value":"https://bigbadbotnet.invalid",...}' python -m urlhaus '{"artifactType":"url","value":"https://bigbadbotnet.invalid",...}'
``` ```
To manually test an analyzer outside of the Sensoroni Docker container, use a command similar to the following:
```bash
PYTHONPATH=. python urlhaus/urlhaus.py '{"artifactType":"url","value":"https://bigbadbotnet.invalid",...}'
```
It is up to each analyzer to determine whether the provided input is compatible with that analyzer. This is assisted by the analyzer metadata, as described earlier in this document, with the use of the `supportedTypes` list. It is up to each analyzer to determine whether the provided input is compatible with that analyzer. This is assisted by the analyzer metadata, as described earlier in this document, with the use of the `supportedTypes` list.
Once the analyzer completes its functionality, it must terminate promptly. See the following sections for more details on expected internal behavior of the analyzer. Once the analyzer completes its functionality, it must terminate promptly. See the following sections for more details on expected internal behavior of the analyzer.